SHF: Small: Architectural Support for Securing Deep Neural Networks

基于深度神经网络的机器学习算法已经在垃圾邮件检测、流量分析、入侵检测、医疗预测和金融预测等多个领域取得了显著的成果。神经网络（NN）驱动的技术，如图像/语音识别和个人辅助应用程序，大大提高了生活质量，并已成为人们日常依赖的实用工具。基于神经网络的机器学习算法通常托管在云服务器上，作为提供给用户的服务，这涉及到他们的安全性，即如何保护用户的私人数据免受黑客以及受信任但好奇的服务器的攻击;如何保护模型盗版并实施知识产权（IP）保护。采用传统的基于加密的防御往往会给系统带来严重的性能下降。该项目解决了这些问题，从而有助于在计算云和移动的客户端中增加机器学习加速器架构的使用。它确保用户的IP受到安全保护。这项工作将研究与高等教育结合起来，在本科和研究生阶段进行课程创新，并与代表性不足的群体和K-12教育进行外联。 该项目开发了一个安全，隐私保护和保密和防篡改的环境，供用户从云获取服务。它侧重于三项任务。1)通过用户相关建模进行IP保护：开发轻量级训练和推理方法，以生成只能在合法IP所有者上执行的模型。这种依赖性可以从目标硬件或IP所有者之间共享的秘密中导出。2)数据隐私保护：加速技术被开发用于隐私保护密码同态加密（HE），其在加密数据上运行NN，但是可以将推理减慢几个数量级。分析了HE，选择了最合适的加速器，并开发了HE到加速器的优化映射，以最大化其性能。3)保护NN的机密性和完整性，防御旁路攻击：通过增加内存加密、身份验证、总线保护和隔离来保护NN的动态执行，以防御针对加速器硬件的复杂攻击。该项目中的建议设计利用NN的独特性，并实现对性能的最小影响。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Machine learning algorithms based on deep neural networks have achieved remarkable results in a variety of domains such as spam detection, traffic analysis, intrusion detection, medical predictions, and financial predictions. Neural network (NN) driven technologies such as image/voice recognition and personal assistance apps have greatly improved the quality of life and have become utilities people rely on everyday. NN-based machine learning algorithms are often hosted on cloud servers as a service provided to users, which concerns their security, that is, how to protect user private data from hackers as well as trusted-yet-curious servers; how to protect model piracy and enforce intellectual property (IP) protection. Adopting traditional encryption based defenses tends to introduce severe performance degradation to the system. This project addresses these issues and thus help increase the use of accelerator architectures for machine learning in the computing cloud and mobile clients. It assures the IP of users are securely protected. The work integrates research with high education with curricular innovation at both the undergraduate and graduate levels and with outreach to under-represented groups and K-12 education. This project develops a secure, privacy-preserving and confidential and tamper-proofing environment for users to acquire services from the cloud. It focuses on three tasks. 1) IP protection via user dependent modeling: lightweight training and inference methodologies are developed to produce models that can only execute on legitimate IP owners. Such dependency can be derived from either target hardware or a secret shared among IP owners. 2) Data privacy protection: acceleration techniques are developed for a privacy-preserving cryptographic homomorphic encryption (HE) which runs NN on encrypted data but could slow down an inference by several orders of magnitude. HE is analyzed, the most suitable accelerator is selected and optimized mapping of HE onto the accelerator is developed to maximize its performance. 3) Protection for confidentiality and integrity of NN, and defend side-channel attacks: protect dynamic execution of NNs by adding memory encryption, authentication, bus protection and isolation to defend sophisticated attacks targeted at the accelerator hardware. The proposed designs in this project exploit uniqueness of NN and achieve minimum impact on performance.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.